Sigma detection rules, expert-reviewed

Windows File Events: Known Offensive PowerShell Script File Creation

Alerts on creation of known offensive PowerShell/PowerShell module filenames on Windows.

Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Alerts when mshta/PowerShell and similar script hosts spawn tasks, download/transfer, or utility tools on Windows.

Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY

Flags PowerShell-launched schtasks.exe /Create commands matching default PowerSploit/Empire scheduled task persistence behavior.

PowerShell Credential Prompt via PromptForCredential

Flags PowerShell scripts that reference "PromptForCredential", indicating credential prompt behavior in Script Block Logging.

PowerShell downgrade indicators via EngineVersion=2. and HostVersion !=2. (Windows)

Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.

Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)

Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.

Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

Flags outbound network connections initiated by PowerShell on Windows, excluding common local and private IP ranges.

Windows PowerShell ScriptBlock with Encoded, Hidden, or Noninteractive Execution Parameters

Alerts on PowerShell ScriptBlockText containing encoded command, hidden window, or noninteractive execution parameters.

Suspicious PowerShell Module Execution Using Encoded, Hidden, or Noninteractive Context (Windows)

Alerts on PowerShell module executions using encoded commands, hidden windows, or noninteractive flags to evade visibility and interaction.

Suspicious PowerShell Script Block Invocations Using Encoded/Hidden Execution and Persistence Commands

Flags PowerShell script blocks using hidden/non-interactive execution, encoded/decode patterns, iex execution, web downloads, or run key modifications.

PowerShell ScriptBlock WebClient Download Calls

Alert on PowerShell ScriptBlock text that uses System.Net.WebClient to download files or strings from the Internet.

Windows PowerShell Script Block Logging: PSAttack marker string

Alerts when PowerShell script blocks contain the "PS ATTACK!!!" marker on Windows.

Windows PowerShell Script Block Contains Exploitation Framework and Credential Theft Keywords

Alerts on PowerShell script block text containing known exploitation, token, and memory-related keywords.

Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Alerts when PowerShell ScriptBlock text includes strings matching known malicious commandlets from common exploitation toolsets.

Suspicious PowerShell Module Usage with Hidden/Encoded Execution Parameters on Windows

Flags hidden or encoded PowerShell invocations that decode/execute code or download-and-execute patterns, while filtering a Chocolatey installer snippet.